Base64 Encoder/Decoder — Encode and Decode Base64 Strings Instantly
That "Authorization: Basic dXNlcjpwYXNz" header you see in HTTP logs? It's just your credentials encoded in Base64. This Base64 encoder / decoder converts any text to Base64 and back instantly — paste "user:pass" and get "dXNlcjpwYXNz"; paste a JWT payload and read the raw JSON inside it. Developers use it daily for HTTP auth headers, decoding JWT tokens, embedding images in CSS data URIs, and inspecting Kubernetes secrets. No signup, runs entirely in your browser.
What Is Base64 Encode / Decode?
A Base64 encoder/decoder converts binary data into a text-safe ASCII string representation — and back again. Base64 takes any binary input (an image, a PDF, a string of bytes) and encodes it using only 64 safe ASCII characters (A-Z, a-z, 0-9, +, /). This makes binary data safe to transmit through text-only channels like email, JSON APIs, URL parameters, and XML documents that don't handle raw binary reliably.
Developers encounter Base64 everywhere: Authorization headers in HTTP requests (Basic Auth sends credentials as Base64), JWT tokens contain Base64-encoded header and payload sections, CSS data URIs embed images as Base64 strings, and SAML authentication assertions are Base64-encoded XML. Understanding how to encode and decode Base64 is a fundamental developer skill. This tool lets you quickly encode any text string or decode a Base64 string back to plain text without writing code.
Hello World→SGVsbG8gV29ybGQ=Before & After: Base64 Encode / Decode Examples
Real input → output pairs showing exactly what this tool does to your text.
| Input | Base64 Encode / Decode Output |
|---|---|
Hello World | SGVsbG8gV29ybGQ= |
user:password | dXNlcjpwYXNzd29yZA== |
eyJhbGciOiJIUzI1NiJ9 (decode) | {"alg":"HS256"} |
{"id":1} | eyJpZCI6MX0= |
A | QQ== |
Key Features
Uses the Base64 alphabet defined in RFC 4648 (2006): A–Z, a–z, 0–9, +, / — the same alphabet used in HTTP Basic Auth (RFC 7617), JWT (RFC 7519), data URIs (RFC 2397), and PEM certificates.
Input is analysed automatically — Base64-looking input decodes to text; other input encodes to Base64. No mode switching required.
Paste the middle segment of any JWT (the characters between the first and second dot) to read the raw JSON claims — expiry, subject, and custom fields — without writing code.
Encoding and decoding happen entirely in your browser. Credentials, API keys, and secret values never leave your device.
When to Use Base64 Encode / Decode
Use for encoding binary data in JSON/XML, embedding images in CSS, or passing data through ASCII-only systems.
Base64 increases data size by ~33%. It is encoding, not encryption — anyone can decode it.
Who Should Use This Tool?
Encode credentials for Basic Auth headers, decode JWT payload sections, and inspect Base64-encoded API tokens and authentication data.
Decode Base64-encoded secrets in environment variables, Kubernetes secrets, and CI/CD pipeline configurations for debugging.
Generate Base64 data URIs for embedding small images directly in CSS and HTML without separate HTTP requests.
Industry Standard
Base64 was standardised in RFC 4648 (2006), superseding earlier RFCs. It was designed in the 1980s for MIME email attachments — a way to safely transmit binary data through systems that only handled 7-bit ASCII. Today it is used in HTTP Basic Auth (RFC 7617), JWT tokens (RFC 7519), data URIs (RFC 2397), and TLS certificates (PEM format). The Base64url variant (RFC 4648 §5) replaces + with - and / with _ for safe use in URLs and filenames.
Key Use Cases
- →Decode a JWT token's payload section (the middle segment) to inspect claims, expiry time, and user data.
- →Encode username:password as Base64 for constructing HTTP Basic Authentication headers manually.
- →Generate Base64 data URIs for small images or SVGs to embed directly in CSS background-image properties.
- →Decode Base64-encoded environment variable values in Docker secrets, Kubernetes secrets, and CI/CD configs.
- →Encode binary file content as Base64 for embedding in JSON API payloads that require string-only values.
Base64 Encode / Decode vs Other Formats
How this tool compares to related approaches and methods
| Method / Format | Best For |
|---|---|
| THISThis tool | Quick encode/decode for auth headers, JWT inspection, data URIs, and Base64-encoded secrets |
| Terminal: base64 (macOS/Linux) | Shell scripts, CI/CD pipelines, and automation that needs Base64 without writing code |
| JavaScript btoa() / atob() | In-browser JavaScript code — btoa handles ASCII; use TextEncoder for Unicode/emoji input |
| Python base64 module | Server-side scripts, encoding binary file content, and applications requiring programmatic control |
Base64 Encode / Decode Rules: How It Works
- →Every 3 bytes of input are converted to 4 Base64 characters — a 33% size increase is always expected.
- →Output uses 64 safe ASCII characters: A–Z, a–z, 0–9, +, / — safe for text-only channels like JSON and email.
- →Padding (=) is added at the end to make output length a multiple of 4 when input length isn't divisible by 3.
- →Encoding is case-sensitive — "Hello" and "hello" produce different Base64 strings.
- →Base64 is encoding, not encryption — anyone who sees the output can decode it instantly.
- ×Password storage — Base64 is trivially reversible. Use bcrypt, Argon2, or scrypt for passwords.
- ×Secure data transmission — Base64 provides zero security. Use HTTPS for transport security.
- ×Large binary files — the 33% overhead is significant for large assets. Use binary protocols instead.
- ×URL query parameters — use Base64url (replaces + with - and / with _) for URL contexts, not standard Base64.
Where It's Applied
How to Use Base64 Encode / Decode
- Select Encode or Decode using the toggle buttons.
- Paste your text into the Input Text box.
- The result appears instantly on the right.
- Click Copy to copy the output to your clipboard.
This Converter vs Manual Methods
Why use this tool instead of doing it by hand?
| Method | Limitation |
|---|---|
| Terminal base64 command | Requires a terminal; not available in browser or on Windows without WSL |
| JavaScript btoa() | Throws for non-Latin1 strings including emoji — requires TextEncoder wrapper for Unicode |
| Python base64 module | Requires coding knowledge; not suitable for quick one-off encode/decode tasks |
| Online Base64 site (other) | Input may be logged by the server — not safe for passwords, API keys, or JWT tokens |
| ✓ BESTThis tool | None |
Common Mistakes & Pro Tips
- !Confusing Base64 with encryption — Base64 is encoding, not encryption. A Base64-encoded string is trivially reversible by anyone. Never use Base64 to "secure" passwords, tokens, or sensitive data. It provides zero security — only format conversion.
- !Forgetting about Base64 URL-safe variant — standard Base64 uses + and / which are special characters in URLs. JWT tokens and URL parameters use Base64url, which replaces + with - and / with _. Decoding standard Base64 with a URL-safe decoder (or vice versa) produces errors or corrupted output.
- !Assuming Base64-encoded data is safe to store in a URL query parameter — standard Base64 contains + and / which are reserved characters in URLs. Always use Base64url (+ → -, / → _) for URL contexts, or percent-encode the Base64 output. JWT tokens already use Base64url for this reason.
Frequently Asked Questions
Everything you need to know about Base64 Encode / Decode
Why does Base64 encoding increase data size by 33%?
+
Base64 encodes every 3 bytes of binary data into 4 ASCII characters. Since 3 bytes = 24 bits and 4 Base64 characters also represent 24 bits (6 bits each), the encoding is lossless but the character-to-byte ratio is 4:3 — a 33% size increase. Padding characters (=) are added to make the output length a multiple of 4 when the input isn't divisible by 3. This overhead is the cost of binary-to-text safety.
How do I decode a JWT token?
+
A JWT consists of three Base64url-encoded sections separated by dots: header.payload.signature. To inspect the payload, take the middle section and Base64-decode it. Note: use Base64url decoding (which handles - and _ instead of + and /). The decoded payload is JSON containing claims like sub (subject/user ID), exp (expiry timestamp), and any custom fields. Never trust a JWT payload without also verifying the signature.
What is a Base64 data URI?
+
A data URI embeds file content directly in a URL rather than linking to an external file. The format is: data:[MIME type];base64,[Base64 encoded content]. Example: data:image/png;base64,iVBORw0KGgo... This lets you embed images directly in CSS (background-image: url("data:image/png;base64,...")) or in HTML img src attributes, eliminating a separate HTTP request. Best for small assets under ~10KB to avoid performance impact.
Is Base64 the same as hex encoding?
+
No — they're different binary-to-text encodings. Hex (hexadecimal) represents each byte as two hex characters (0-9, a-f), producing output twice the original size. Base64 represents every 3 bytes as 4 characters, producing output 33% larger than the original. Base64 is more space-efficient. Hex is more readable for byte-level inspection (common in cryptography and network debugging). SHA/MD5 hashes are typically displayed in hex.
Can Base64 encode any type of file?
+
Yes — Base64 is format-agnostic. It works on any binary data: images (PNG, JPEG, GIF, WebP), documents (PDF, Word), audio (MP3, WAV), and arbitrary binary blobs. The encoder treats all input as a stream of bytes. However, this tool is a text-based Base64 encoder — it encodes the UTF-8 bytes of your text input. For binary files, you'd use a file-based Base64 encoder (command line: base64 filename.bin).
What is the history of Base64 encoding?
+
Base64 was developed in the early 1980s to solve a specific problem: email servers and protocols at the time handled only 7-bit ASCII text, but emails needed to carry 8-bit binary attachments (images, executables, documents). The solution was to encode binary data using only 64 safe ASCII characters. This technique was standardized in MIME (Multipurpose Internet Mail Extensions) in RFC 1341 (1992) and later in RFC 4648 (2006). The name "Base64" refers to the 64-character alphabet used.
What does the = padding at the end of Base64 mean?
+
Base64 processes input in groups of 3 bytes, producing 4 characters per group. When the input length isn't divisible by 3, padding = characters are added to make the output length a multiple of 4. One = means the last group had 2 input bytes; == means it had 1 input byte. Padding is required by RFC 4648 for standard Base64 but is often omitted in Base64url contexts (JWT, URL-safe encoding). A decoder must handle both padded and unpadded input.